Week 7: Cryptography, Virtualization, and Final Review
Week of Sun, Oct 4 · week closes Mon, Oct 5 · 250 points
This week's items
- Weekly Quiz 7points in Canvas
- Discussion Board 7points in Canvas
- Lab 7points in Canvas
- Final Examdue Mon, Oct 5 · 250 pts
Exact due times are in Canvas. Late assignments are NOT accepted. Complete all assignments before the due date.
Read this week
- TestOut Ethical Hacker Pro — Ch 19–20 — Commercial text; named here for reference.
- NIST FIPS 197 — Advanced Encryption Standard — Free — the NIST AES standard document.
- NIST SP 800-57 — Key Management Recommendations — Free — minimum key size recommendations.
Know these cold
- Cryptography types: symmetric (one key, fast — AES, 3DES) vs. asymmetric (public/private key pair, slow — RSA, ECC); hashing (one-way, fixed-length digest — SHA-256, MD5).
- AES with 256-bit keys is the NIST-approved symmetric standard; DES (56-bit) and 3DES are deprecated; RC4 is broken.
- RSA is the foundational asymmetric algorithm; minimum 2048-bit key size is the current standard; ECC provides equivalent security at smaller key sizes.
- PKI governs certificate issuance, the CA hierarchy, and revocation (via CRL or OCSP) — the mechanism behind every HTTPS connection.
- TLS 1.3 is the current standard: it removed deprecated cipher suites, mandated forward secrecy (ECDHE), and reduced the handshake to one round trip.
- Virtualization attack surfaces: VM escape (breaking hypervisor isolation), hypervisor vulnerabilities, and shared-resource attacks.
- Cloud shared responsibility model: IaaS (customer secures OS and above), PaaS (customer secures application and data), SaaS (customer manages users and access control only).
- Standards: Maryland Blueprint Pillar 3 · CEH v12 Domain 19 (Cryptography) + Domain 20 (Cloud) · PGCC Outcomes 3, 5, 7.
Meerk's quiz — open the Week 7 gate
10 questions, no time limit. 85% on your first attempt in a 24-hour window opens the gate. Retakes inside the window are practice — they help you learn, they don't count. Work alone; the point is to know it, not to have seen it.
Dinner Table Question
Ask at home: A client asks why their penetration test used HTTPS traffic for the simulated C2 channel. What is the attacker's advantage and the defender's detection approach?
En español: Un cliente pregunta por qué la prueba de penetración usó tráfico HTTPS para el canal C2. ¿Cuál es la ventaja del atacante y el enfoque de detección del defensor?